docker-compose.noosphere.yml

# Noosphere production Compose template for OpenClaw users.
# Defaults are intentionally localhost-only. Override BIND_ADDRESS,
# NOOSPHERE_PORT, or APP_URL in .env if needed.
name: noosphere

services:
  init:
    image: ghcr.io/sweetsophia/noosphere:${NOOSPHERE_VERSION:-latest}
    container_name: noosphere-openclaw-init
    restart: "no"
    environment:
      NOOSPHERE_BOOTSTRAP_DATABASE_URL: postgresql://noosphere:${POSTGRES_PASSWORD}@db:5432/noosphere
      DATABASE_URL: postgresql://noosphere_migrator:${POSTGRES_MIGRATION_PASSWORD}@db:5432/noosphere
      NOOSPHERE_APP_DATABASE_URL: postgresql://noosphere_app:${POSTGRES_APP_PASSWORD}@db:5432/noosphere
      POSTGRES_HYBRID_ADMIN_PASSWORD: ${POSTGRES_HYBRID_ADMIN_PASSWORD:-}
      POSTGRES_HYBRID_WORKER_PASSWORD: ${POSTGRES_HYBRID_WORKER_PASSWORD:-}
      NOOSPHERE_ADMIN_PASSWORD: ${NOOSPHERE_ADMIN_PASSWORD:-}
      NOOSPHERE_ADMIN_PASSWORD_RESET: ${NOOSPHERE_ADMIN_PASSWORD_RESET:-false}
      NOOSPHERE_FORCE_ADMIN: ${NOOSPHERE_FORCE_ADMIN:-false}
      NOOSPHERE_BOOTSTRAP_API_KEY: ${NOOSPHERE_BOOTSTRAP_API_KEY:-}
      NOOSPHERE_BOOTSTRAP_SECRETS_FILE: ${NOOSPHERE_BOOTSTRAP_SECRETS_FILE:-/tmp/noosphere-bootstrap-secrets/secrets.json}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      NEXTAUTH_URL: ${APP_URL:-http://127.0.0.1:6578}
      APP_URL: ${APP_URL:-http://127.0.0.1:6578}
      UPLOAD_DIR: /app/uploads
      PG_POOL_MAX: ${PG_POOL_MAX:-20}
      PG_IDLE_TIMEOUT_MS: ${PG_IDLE_TIMEOUT_MS:-30000}
      PG_CONN_TIMEOUT_MS: ${PG_CONN_TIMEOUT_MS:-5000}
      REDIS_URL: redis://redis:6379
      NOOSPHERE_MEMORY_RECALL_RATE_LIMIT_PER_MINUTE: ${NOOSPHERE_MEMORY_RECALL_RATE_LIMIT_PER_MINUTE:-120}
    entrypoint: ["/bin/sh", "-ceu", "--"]
    command:
      - |
          if [ -n "$$POSTGRES_HYBRID_ADMIN_PASSWORD" ] || [ -n "$$POSTGRES_HYBRID_WORKER_PASSWORD" ]; then
            if [ -z "$$POSTGRES_HYBRID_ADMIN_PASSWORD" ] || [ -z "$$POSTGRES_HYBRID_WORKER_PASSWORD" ]; then
              echo 'Both Phase B database passwords must be configured together.' >&2
              exit 78
            fi
            export NOOSPHERE_HYBRID_ADMIN_DATABASE_URL="postgresql://noosphere_hybrid_admin_login:$$POSTGRES_HYBRID_ADMIN_PASSWORD@db:5432/noosphere"
            export NOOSPHERE_HYBRID_WORKER_DATABASE_URL="postgresql://noosphere_hybrid_worker_login:$$POSTGRES_HYBRID_WORKER_PASSWORD@db:5432/noosphere"
          fi
          node docker/provision-database-roles.mjs
          node docker/migrate-or-baseline.mjs
          # Migrations may create tables or routines. Re-provision so the
          # limited app role receives only the current exact runtime grants.
          node docker/provision-database-roles.mjs
          node docker/bootstrap.mjs
    volumes:
      - noosphere_uploads:/app/uploads:rw
    depends_on:
      db:
        condition: service_healthy

  app:
    image: ghcr.io/sweetsophia/noosphere:${NOOSPHERE_VERSION:-latest}
    entrypoint:
      - /bin/sh
      - -ceu
      - |
          marker=/run/noosphere-pgvector/writer-authorized
          actual="$$(cat "$$marker" 2>/dev/null || true)"
          if [ "$$actual" != 'ghcr.io/sweetsophia/noosphere-postgres-pgvector@sha256:12bc9b34226803a04811a3ddd06feac14121c2c7ce369aaddbd778d242751292' ]; then
            echo 'Noosphere writer authorization is incomplete; finish the guarded transition.' >&2
            exit 78
          fi
          exec /app/docker/docker-entrypoint.sh "$$@"
      - --
    command: ["node", "server.js"]
    container_name: noosphere-openclaw-app
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "${BIND_ADDRESS:-127.0.0.1}:${NOOSPHERE_PORT:-6578}:3000"
    environment:
      DATABASE_URL: postgresql://noosphere_app:${POSTGRES_APP_PASSWORD}@db:5432/noosphere
      SKIP_MIGRATION: "1"
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      NEXTAUTH_URL: ${APP_URL:-http://127.0.0.1:6578}
      APP_URL: ${APP_URL:-http://127.0.0.1:6578}
      UPLOAD_DIR: /app/uploads
      PG_POOL_MAX: ${PG_POOL_MAX:-20}
      PG_IDLE_TIMEOUT_MS: ${PG_IDLE_TIMEOUT_MS:-30000}
      PG_CONN_TIMEOUT_MS: ${PG_CONN_TIMEOUT_MS:-5000}
      REDIS_URL: redis://redis:6379
      NOOSPHERE_MEMORY_RECALL_RATE_LIMIT_PER_MINUTE: ${NOOSPHERE_MEMORY_RECALL_RATE_LIMIT_PER_MINUTE:-120}
      NOOSPHERE_HYBRID_RETRIEVAL_ENABLED: ${NOOSPHERE_HYBRID_RETRIEVAL_ENABLED-false}
      NOOSPHERE_HYBRID_QUERY_PROFILE_ID: ${NOOSPHERE_HYBRID_QUERY_PROFILE_ID:-}
      NOOSPHERE_HYBRID_CACHE_HMAC_ACTIVE_VERSION: ${NOOSPHERE_HYBRID_CACHE_HMAC_ACTIVE_VERSION:-}
      NOOSPHERE_HYBRID_CACHE_HMAC_KEYS_B64: ${NOOSPHERE_HYBRID_CACHE_HMAC_KEYS_B64:-}
      NOOSPHERE_HYBRID_PROVIDER_CONFIG_B64: ${NOOSPHERE_HYBRID_PROVIDER_CONFIG_B64:-W10=}
      NOOSPHERE_HYBRID_REQUEST_TIMEOUT_MS: ${NOOSPHERE_HYBRID_REQUEST_TIMEOUT_MS:-30000}
      NOOSPHERE_HYBRID_MAX_RESPONSE_BYTES: ${NOOSPHERE_HYBRID_MAX_RESPONSE_BYTES:-4194304}
    volumes:
      - noosphere_uploads:/app/uploads:rw
      - noosphere_postgres_authorization:/run/noosphere-pgvector:ro
    depends_on:
      init:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 45s

  hybrid-worker:
    image: ghcr.io/sweetsophia/noosphere:${NOOSPHERE_VERSION:-latest}
    profiles: ["hybrid"]
    entrypoint:
      - /bin/sh
      - -ceu
      - |
          marker=/run/noosphere-pgvector/writer-authorized
          actual="$$(cat "$$marker" 2>/dev/null || true)"
          if [ "$$actual" != 'ghcr.io/sweetsophia/noosphere-postgres-pgvector@sha256:12bc9b34226803a04811a3ddd06feac14121c2c7ce369aaddbd778d242751292' ]; then
            echo 'Noosphere writer authorization is incomplete; finish the guarded transition.' >&2
            exit 78
          fi
          exec /app/docker/docker-entrypoint.sh "$$@"
      - --
    command: ["node", "scripts/hybrid-worker.mjs"]
    container_name: noosphere-openclaw-hybrid-worker
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      SKIP_MIGRATION: "1"
      NOOSPHERE_HYBRID_WORKER_DATABASE_URL: postgresql://noosphere_hybrid_worker_login:${POSTGRES_HYBRID_WORKER_PASSWORD:-HYBRID_WORKER_PASSWORD_NOT_CONFIGURED}@db:5432/noosphere
      NOOSPHERE_HYBRID_PROVIDER_CONFIG_B64: ${NOOSPHERE_HYBRID_PROVIDER_CONFIG_B64:-W10=}
      NOOSPHERE_HYBRID_WORKER_CONCURRENCY: ${NOOSPHERE_HYBRID_WORKER_CONCURRENCY:-4}
      NOOSPHERE_HYBRID_LEASE_SECONDS: ${NOOSPHERE_HYBRID_LEASE_SECONDS:-120}
      NOOSPHERE_HYBRID_MAX_ATTEMPTS: ${NOOSPHERE_HYBRID_MAX_ATTEMPTS:-8}
      NOOSPHERE_HYBRID_WORKER_POLL_MS: ${NOOSPHERE_HYBRID_WORKER_POLL_MS:-1000}
      NOOSPHERE_HYBRID_REQUEST_TIMEOUT_MS: ${NOOSPHERE_HYBRID_REQUEST_TIMEOUT_MS:-30000}
      NOOSPHERE_HYBRID_MAX_RESPONSE_BYTES: ${NOOSPHERE_HYBRID_MAX_RESPONSE_BYTES:-4194304}
      NOOSPHERE_HYBRID_QUEUE_WARNING_DEPTH: ${NOOSPHERE_HYBRID_QUEUE_WARNING_DEPTH:-1000}
      NOOSPHERE_HYBRID_QUEUE_CRITICAL_DEPTH: ${NOOSPHERE_HYBRID_QUEUE_CRITICAL_DEPTH:-10000}
      NOOSPHERE_HYBRID_QUEUE_WARNING_AGE_SECONDS: ${NOOSPHERE_HYBRID_QUEUE_WARNING_AGE_SECONDS:-300}
      NOOSPHERE_HYBRID_QUEUE_CRITICAL_AGE_SECONDS: ${NOOSPHERE_HYBRID_QUEUE_CRITICAL_AGE_SECONDS:-1800}
      NOOSPHERE_HYBRID_WORKER_HEALTH_FILE: /tmp/noosphere-hybrid-worker/health.json
    volumes:
      - noosphere_postgres_authorization:/run/noosphere-pgvector:ro
    depends_on:
      init:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "node", "scripts/check-hybrid-worker-health.mjs"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

  db:
    image: ghcr.io/sweetsophia/noosphere-postgres-pgvector@sha256:12bc9b34226803a04811a3ddd06feac14121c2c7ce369aaddbd778d242751292
    entrypoint:
      - /bin/sh
      - -ceu
      - |
          marker=/run/noosphere-pgvector/candidate-authorized
          actual="$$(cat "$$marker" 2>/dev/null || true)"
          if [ "$$actual" != 'ghcr.io/sweetsophia/noosphere-postgres-pgvector@sha256:12bc9b34226803a04811a3ddd06feac14121c2c7ce369aaddbd778d242751292' ]; then
            echo 'PostgreSQL candidate authorization is missing; run the guarded installer or switch.' >&2
            exit 78
          fi
          exec /usr/local/bin/docker-entrypoint.sh "$$@"
      - --
    command: ["postgres"]
    container_name: noosphere-openclaw-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: noosphere
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: noosphere
    volumes:
      - noosphere_postgres_data:/var/lib/postgresql/data
      - noosphere_postgres_authorization:/run/noosphere-pgvector:ro
    healthcheck:
      test: ["CMD-SHELL", "[ \"$$(cat /proc/1/comm 2>/dev/null)\" = postgres ] && [ \"$$(psql -XAtq -v ON_ERROR_STOP=1 -U noosphere -d noosphere -c 'SELECT 1;' 2>/dev/null)\" = 1 ]"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  redis:
    image: redis:7-alpine
    container_name: noosphere-openclaw-redis
    restart: unless-stopped
    volumes:
      - noosphere_redis_data:/data
    command: redis-server --save "" --appendonly no
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s

volumes:
  noosphere_postgres_data:
    name: noosphere_postgres_data
    driver: local
  noosphere_postgres_authorization:
    name: noosphere_postgres_authorization
    external: true
  noosphere_uploads:
    name: noosphere_uploads
    driver: local
  noosphere_redis_data:
    name: noosphere_redis_data
    driver: local